CVE-2023-0441
High
Description
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
SeverityHigh
CVSS8.1
Exploit probability—
ProductSimplygallery Simply Gallery Blocks With Lightbox
PublishedMar 27, 2023
First seenMar 27, 2023
Weakness typeCWE-862Missing authorization
How to fix
Update
- simplygallery simply_gallery_blocks_with_lightbox3.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplygallery simply_gallery_blocks_with_lightbox | v < 3.0.8 | 3.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.